Retention policy for Cortex XSOAR multi-tenant and MSSP users.
By default, each child tenant has 180 days (6 months) of incident retention. The retention period is calculated from the date the incident was created in Cortex XSOAR. You can purchase incident retention licenses to extend the incident retention of one or more child tenants. These licenses, once purchased, are available for allocation to child tenants in the Cortex Gateway.
Each incident retention license adds 1 month of incident retention. For example, a child tenant with a default of six months plus three incident retention licenses would have a total of nine months of incident retention.
Note
Once an incident retention license has been assigned to a child tenant, the license cannot be removed from the child tenant or assigned to another child tenant via the Cortex Gateway. If you need to remove or reassign an incident retention license, contact Customer Support.
If you delete a child tenant, any incident retention licenses assigned to that tenant are returned to the main account and can be reallocated.
To allocate licenses when you create a child tenant, follow the instructions when creating a tenant. For more information, see Step 2. Create a child tenant
To allocate licenses to an existing child tenant:
Log into the Cortex Gateway.
Under the main account, you can see the total number of incident retention licenses and the total number currently assigned to child tenants.
Hover over the child tenant until the three-dot menu appears. Open the menu and select Manage Incident Retention Licenses.
In the Manage Incident Retention Licenses window, assign one or more incident retention licenses to the child tenant. You cannot reduce the number of licenses already assigned.
Click the box to verify you understand that licenses cannot be removed or reallocated without contacting Customer Support.
Save your changes.
To view the period for incident retention for a child tenant, go to → . This includes any retention add-ons you have purchased. For example, if you have purchased an additional 6 months of retention, you can see 12 Months of incidents retention (6 months default period + 6 months of paid licenses).